microsoft / onefuzz

A self-hosted Fuzzing-As-A-Service platform
MIT License
2.82k stars 199 forks source link

Improve bug title generation & stack parsing #3337

Open Porges opened 1 year ago

Porges commented 1 year ago

With enough regular expressions, we can fix anything.

Finishes addressing #3335.

Instead of simply reusing the ASan Summary value as output for the crash_site, I suggest that we generate a new one in a very similar format. This allows us to point to the top stack frame of the minimized stack trace as the source of the problem, hopefully skipping non-user code. The crash_site is directly used in the titles of bugs filed by OneFuzz.

As an example, we currently generate:

AddressSanitizer: SEGV (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-release_3e8ee0f0e660f39ebe723667101aab55a53e781c/symbolized/release/asan-symbolized-linux-release-v8-component-33791/chrome+0x90a7242)

After this change we would generate instead:

AddressSanitizer: SEGV (third_party/WebKit/Source/platform/heap/Handle.h:824 in blink::Member<blink::StyleEngine>::get() const)

Open questions

Parsing improvements

At the same time I've made changes to improve how we parse the stack traces, based upon our existing corpus:

Two changes break supposed compatibility with ClusterFuzz:

These changes are good to bundle together because they affect the stack hash generation (see next section).

Fallout

If we change the stack minimization and title generation this will result in differences for bug deduplication (currently this is by default done with a combination of the title and minimized stack hash). So existing un-fixed bugs may get refiled by OneFuzz.

codecov-commenter commented 1 year ago

Codecov Report

Merging #3337 (973e672) into stacktrace-fixes (a9ac78e) will increase coverage by 0.10%. The diff coverage is n/a.

@@                 Coverage Diff                  @@
##           stacktrace-fixes    #3337      +/-   ##
====================================================
+ Coverage             31.84%   31.94%   +0.10%     
====================================================
  Files                   307      307              
  Lines                 37361    37421      +60     
====================================================
+ Hits                  11897    11954      +57     
- Misses                25464    25467       +3     
Files Changed Coverage Δ
src/agent/onefuzz/src/input_tester.rs 0.00% <ø> (ø)
src/agent/stacktrace-parser/src/asan.rs 100.00% <ø> (ø)
src/agent/stacktrace-parser/src/lib.rs 90.79% <ø> (+0.48%) :arrow_up: